Customer information was exposed in a breach of Gnosis Pay’s legacy consumer-card system, the company says. It reports no impact on funds or its enterprise platform.
The November 6 incident statement dates detection to November 3, 2026, and separates Gnosis Pay-branded consumer cards from the enterprise infrastructure serving white-label programmes.
Different customers, different exposed details
Protos reported that customer notifications described different sets of compromised information. One notification listed the name printed on a card, a shipping address and an account reference. The outlet also cited Rotki founder Lefteris Karapetsas, who said his notification included his home address, name, card number and wallet addresses linked to his account.
Those reports should not be read as a uniform list for every affected user. The practical starting point is each customer’s individual notification.
Linking a physical address to a crypto account can make impersonation more convincing and turn an online privacy problem into a personal-safety concern. That is a risk arising from the combination of information; it is not evidence that such targeting has occurred in this incident.
Containment and customer precautions
The company says it replaced credentials and addressed the vulnerability after starting containment within two hours. It added mandatory 3D Secure for online payments before the system’s planned December 20 retirement.
Customers should check unexpected messages through the official app. Gnosis Pay says unsolicited communications will never request seed phrases, private keys, PINs or transfers.
The notice omits a customer total and technical root cause. Remediation is a company statement, without an independently verified assessment.
